20 ms·

While unfortunate for any affected individuals, still IMHO a much smaller problem than a few companies have basically full control over all computers people use

While unfortunate for any affected individuals, still IMHO a much smaller problem than a few companies have basically full control over all computers people use. That's much more dangerous for the society than a few thieves making a buck.

smoldesu 4y ago
[flagged]
- widowlark 4y ago
  Too true, as evidenced by the comments in this thread. I fear for open computing and software based on what im seeing here.
  - altairprime 4y ago
    “If you don’t know the credentials to reuse it, it’s bricked” is a valid choice whether the hardware is open source or not. Yubikey equivalents that are fully open source still have to be shredded rather than recycled, if properly secured. Open computing isn’t incompatible with secure computing — but secure computing is absolutely incompatible with reusable computing. I have nothing against reusable computing, but I’m tired of seeing “open” and “right to repair” erroneously held up as meaningful solutions to reusable–repurposeable computing. Focusing on the core issue at hand – that you feel we should have the right to repurpose hardware in our possession without impediment – would go a long ways towards starting the correct and necessary conversations about “security” and “anti-theft” that, today, will simply not happen productively under the open/repair banners that the reuse/repurpose movement is trying to ride under.
    - tshaddox 4y ago
      > Open computing isn’t incompatible with secure computing — but secure computing is absolutely incompatible with reusable computing. Is the first part even true? It does seem to me that there are a class of tasks, the most obvious being competitive video games, that do require that the user not have complete control over the hardware and software they're using.
      - altairprime 4y ago
        It is absolutely possible to fully implement an open source hardware stack that builds up from an HSM secure store into a UEFI secure boot chained ti a signed, reproducible-buildable Linux kernel that can launch signed, reproducible-buildable applications and attest, with cryptographic signatures chaining from the hardware HSM clear to the kernel to the application. This is wildly unpalatable, but it’s already fully implemented and available on macOS and enterprise Windows 10+ today. (Seriously: Safari can, on stock macOS, attest to a website that you’re booted securely into an unmodified Apple kernel and OS, so long as your motherboard has the HSM boot chip.) Whether this system is implemented as closed source or as open source is wholly irrelevant to secure attestation, which could be done exactly as it is today even if the complete source code were available. The difficulty is that, for anti-cheat, someone other than the user must have signed the key inside the HSM, or else it can’t be trusted to be unmodified. This is why Secure Boot with Attestation, and the entire objection to Microsoft Proton, turns out to be about repurposeability — people want the right to repurpose hardware without a third-party services, such as anti-cheating checks, being able to exclude them based on their modifications. That’s not about open source at all. That debate is not about open source, and with the advent of widespread secure attestation computing, it’s overdue for serious conversations.
        smoldesu 4y ago
        > people want the right to repurpose hardware without a third-party services Is that wrong? Third-party services are temporary. Hardware lasts forever. If hardware attestation comes at the cost of ephemerally-usable hardware, it's not worth it. It's certainly not worth forcing it onto devices that would otherwise be usable, but instead become landfill because their previous IT team went insolvent. People can (and should) get mad at this, and doing so with the Open Source community is not a mistake. Open Source represents leverage (AKA "Freedom") against corporations that would otherwise harm you for profit. You can excuse this behavior with all sorts of DRM and anticheat, but you'll never win until the kernel stops processing digital input and output. It's a snipe chase, and it's not worth pretending it's not a power grab.
        4y ago
aloer 4y ago
Are you not free to simply not use find my/activation lock? I haven’t used Asahi yet but the way I understand it you can install Asahi right away and the hardware is forever yours to control. And if you are worried about Apple one day remotely adding a lock to your Asahi laptop you can probably block those requests proactively on a network level anyways
tshaddox 4y ago
I tend to agree, but that's not really one of the options on the table for this particular discussion.

smoldesu 4y ago

[flagged]

widowlark 4y ago
Too true, as evidenced by the comments in this thread. I fear for open computing and software based on what im seeing here.
- altairprime 4y ago
  “If you don’t know the credentials to reuse it, it’s bricked” is a valid choice whether the hardware is open source or not. Yubikey equivalents that are fully open source still have to be shredded rather than recycled, if properly secured. Open computing isn’t incompatible with secure computing — but secure computing is absolutely incompatible with reusable computing. I have nothing against reusable computing, but I’m tired of seeing “open” and “right to repair” erroneously held up as meaningful solutions to reusable–repurposeable computing. Focusing on the core issue at hand – that you feel we should have the right to repurpose hardware in our possession without impediment – would go a long ways towards starting the correct and necessary conversations about “security” and “anti-theft” that, today, will simply not happen productively under the open/repair banners that the reuse/repurpose movement is trying to ride under.
  - tshaddox 4y ago
    > Open computing isn’t incompatible with secure computing — but secure computing is absolutely incompatible with reusable computing. Is the first part even true? It does seem to me that there are a class of tasks, the most obvious being competitive video games, that do require that the user not have complete control over the hardware and software they're using.
    - altairprime 4y ago
      It is absolutely possible to fully implement an open source hardware stack that builds up from an HSM secure store into a UEFI secure boot chained ti a signed, reproducible-buildable Linux kernel that can launch signed, reproducible-buildable applications and attest, with cryptographic signatures chaining from the hardware HSM clear to the kernel to the application. This is wildly unpalatable, but it’s already fully implemented and available on macOS and enterprise Windows 10+ today. (Seriously: Safari can, on stock macOS, attest to a website that you’re booted securely into an unmodified Apple kernel and OS, so long as your motherboard has the HSM boot chip.) Whether this system is implemented as closed source or as open source is wholly irrelevant to secure attestation, which could be done exactly as it is today even if the complete source code were available. The difficulty is that, for anti-cheat, someone other than the user must have signed the key inside the HSM, or else it can’t be trusted to be unmodified. This is why Secure Boot with Attestation, and the entire objection to Microsoft Proton, turns out to be about repurposeability — people want the right to repurpose hardware without a third-party services, such as anti-cheating checks, being able to exclude them based on their modifications. That’s not about open source at all. That debate is not about open source, and with the advent of widespread secure attestation computing, it’s overdue for serious conversations.
      - smoldesu 4y ago
        > people want the right to repurpose hardware without a third-party services Is that wrong? Third-party services are temporary. Hardware lasts forever. If hardware attestation comes at the cost of ephemerally-usable hardware, it's not worth it. It's certainly not worth forcing it onto devices that would otherwise be usable, but instead become landfill because their previous IT team went insolvent. People can (and should) get mad at this, and doing so with the Open Source community is not a mistake. Open Source represents leverage (AKA "Freedom") against corporations that would otherwise harm you for profit. You can excuse this behavior with all sorts of DRM and anticheat, but you'll never win until the kernel stops processing digital input and output. It's a snipe chase, and it's not worth pretending it's not a power grab.
        4y ago

aloer 4y ago

Are you not free to simply not use find my/activation lock? I haven’t used Asahi yet but the way I understand it you can install Asahi right away and the hardware is forever yours to control. And if you are worried about Apple one day remotely adding a lock to your Asahi laptop you can probably block those requests proactively on a network level anyways

tshaddox 4y ago

I tend to agree, but that's not really one of the options on the table for this particular discussion.